even with the hassle of developing both iOS and Android, it's got to be less than handling all the browser edge cases for "HTML5."

As someone who deals with Android day in, day out, I really doubt that.

With HTML5 you've got maybe 4 or 5 targets to worry about, targets that have different problems but a limited number all the same.

x (desktop + tablet + smartphone). The same device issues you raise can occur with HTML5, sometimes aggravated by the lack of definitive differentiators/inflection points between devices. How do you detect whether you're on an iPad or an iPhone 6 Plus? CSS media queries still only rely on user-determined heuristics to run different bits of layout/presentation.

Yes, Android device compatibility and OS support variability is a huge concern. I've never done more than tinker with Android, so I can't speak to it, but the issues seem comparable with HTML5, albeit with better (more concrete) APIs. I'd give Android the slight edge here.

Every single flash banner ad on the internet could potentially be as dangerous as downloading and running random EXE files.

For the record, I had been thinking about this some time ago. Before we could get away with being careful and maybe having an antivirus around, but now we can get malware injected just by accessing any random page. It's no wonder that the trend is to sandbox programs as much as possible.

Every single flash banner ad on the internet could potentially be as dangerous as downloading and running random EXE files.

For the record, I had been thinking about this some time ago. Before we could get away with being careful and maybe having an antivirus around, but now we can get malware injected just by accessing any random page. It's no wonder that the trend is to sandbox programs as much as possible.

Now you've got anti-virus programs bundled with malware...

What I do not understand is why so many of you seem fixated on browser-based delivery.

...

I think a lot of it has to do with the generation we grew up in. … The very game mechanics that I sit around thinking about revolve around having access to things like a mouse and keyboard. Making a mobile game is a completely different thought process that requires considering touch controls, tiny screens, a type of game design I don't often think about.

This suggests a worrisome insularity to your own consumptive habits, and a disinterest in monitoring larger trends. The iOS App Store launched 7 years ago, and indie gaming hasn't been the same since. For you to just be reckoning with that now should cause you to ask if you're really an indie developer or just a hobbyist with a lot of idle time. Anyone whose primary concern was getting their games in front of an audience should have realized that the casual gaming audience had moved toward iOS and Android well before now.

Not only that, but for me I primarily associate browser-based game as a no-barrier no-entry requirement to playing a game. No exe's/apks to download, nothing to install, just go to this link and play the game. The same friend above then made another statement that me revile in disgust again: "Oh desktop games are much harder to play - a phone game I can download at any time and then play when I get a chance. Desktop games I can't try at work when I have a few minutes waiting for something to compile".

Ugh, what what what? Going to the app store, finding the game, hoping it works on your device and installing it is easier?

Yes. For one thing, you are completely overlooking the task of installing or updating Flash—and even Flash enthusiasts should be able to admit that, in this day and age, you are often confronted with a need to update the plugin when you activate it, particularly if you're an infrequent user.

On top of that, you ignored what I told you earlier about an app that is on your device being easy to launch, without network access, wherever you may be. Since you think in desktop terms, that means you're not even considering gaming on the go, or the various 5- and 10-minute waiting interstitials that fill our days: lines, queues, elevators, transit, waiting rooms. For many adults, without that ability to grab a little gaming here and there, they'd simply never play. Their lives at work and home are so busy.

The world changed while you weren't looking.

I don't have any disagreement with this in an overall sense, but I do think there are at least some important niches where Flash games are still more successful than mobile games. The easiest example I can think of is horror games, because it's a genre I'm especially comfortable with, and I definitely hear of a lot more flash horror games than horror games targeting mobile devices specifically. I wouldn't be surprised if the primary (or sole) cause is just that horror doesn't work as well in the situations where people want to play phone games.

Another thing I've noticed (and this is definitely a biased sample as well because of my particular interests) is that I see a lot more video reviews / let's plays of Flash games than mobile games. I'm sure the fact that they might be slightly easier to record probably affects this as well.

All in all I still don't think browser games are going to die off completely, even if Flash does. Portals for browser games are still fairly popular, and the fact audience members can very easily jump from game to game with no barrier to entry (since they'll only need to install a couple of plugins and be able to play them all) still seems like a useful way of attracting new players.

... Every single flash banner ad on the internet could potentially be as dangerous as downloading and running random EXE files.

Which...a lot of people still do, surprisingly. Really, we're taking a gamble by just getting online. There's no guarantee that our anti-virus software will know about every single harmful file on the internet, even with regular updates.

I wouldn't trust Anti-virus software with that job. There was a thread about that recently, so I'll just sum up my opinion: if you think you need it, use it. But if it ever triggers on a real threat, you have already done something wrong and who knows how much else slipped into your system unrecognized before that. I have been using AVs for ten or fifteen years and it never triggered on a real threat nor was I ever knowingly infected with something.

If you want to feel significantly safer (perfect safety does not exist, but reasonably safe is very well possible), my number one suggestion would be to uninstall Flash or maybe use a browser which does not load any Flash unless explicitly asked to in each case (click-to-play). After that, I would disable the Java plugin and then go through the other plugins you might have accumulated. I'm going to assume your browser is either automatically updated at high frequency or you are using an older but extremely stable branch with less features but high stability and well-tested security.

At work I don't even have Flash installed anymore. At home I use click-to-play, but I could as well uninstall it since I practically never click.

This flash exploit has mostly been used by government spies up until this point, but now that it's "burned" by the leak, Adobe and anti-virus companies are quickly patching it up.

The Flash vulnerability has been there for what, a decade or more, if the articles are to be believed. And right after Adobe patched that one, two more existing vulnerabilities were discovered in the same set of data...

You guys seem to be surprised about those vulnerabilities and seem to assume they happen accidentially.

The reason why they persist for decades (and are used mainly by government agencies) is that the vulnerabilities have been placed deliberately for that purpose. That's actually pretty obvious (unless you assume that the guys at Adobe are complete idiots). The exploits are now being "fixed" because after they're public, Adobe has no other choice but to fix them to avoid a PR nightmare (and it would be suspicious if they didn't, too).

That feels like tin-foil-hatting to me. There would be far more interesting and productive ways to get government spyware on people's computers. Especially considering your most interesting targets can just avoid you by not installing an optional add-on with a horrible reputation.

I find it far more plausible Adobe is suffering from years of horrible coding practices coupled with low investment in software maintenance. There were a lot of severe security problems with Flash and other Adobe products over the years. Some of those flaws were present for years before being discovered/exploited by your unfriendly neighborhood hacker. If you wanted it as an intrusion vector you would want a piece of software with a good reputation and one extremely difficult to detect flaw only you know about.

I'm just glad that we're generally getting away from the whole idea of browser plug-ins. I can just remember browsing the web in the around 2000, when there was a ridiculous proliferation of different plugin platforms. Shockwave, Flash, Java applets, RealPlayer, MPlayer, WildTangent, and other random ActiveX controls authored by who knows who.

This flash exploit has mostly been used by government spies up until this point, but now that it's "burned" by the leak, Adobe and anti-virus companies are quickly patching it up.

The Flash vulnerability has been there for what, a decade or more, if the articles are to be believed. And right after Adobe patched that one, two more existing vulnerabilities were discovered in the same set of data...

You guys seem to be surprised about those vulnerabilities and seem to assume they happen accidentially.

The reason why they persist for decades (and are used mainly by government agencies) is that the vulnerabilities have been placed deliberately for that purpose. That's actually pretty obvious (unless you assume that the guys at Adobe are complete idiots). The exploits are now being "fixed" because after they're public, Adobe has no other choice but to fix them to avoid a PR nightmare (and it would be suspicious if they didn't, too).

This is true. Well, at least in the industry I work (Financial/Medical billing).

It's no wonder that the trend is to sandbox programs as much as possible.

I'm hoping for the day when someone makes a html5 compatible browser running on the chromium project.

Especially considering your most interesting targets can just avoid you by not installing an optional add-on with a horrible reputation.

Is that so? Let's see what Microsoft has to say about their webbrowser that comes with Windows:

Adobe Flash is included as a platform feature and is available out of the box for Windows 8.1, running on both Internet Explorer and Internet Explorer for the desktop.

You may call it tin-foil-hatting, but National Security Letters are a reality. You wouldn't know (I wouldn't either, obviously) whether companies like Adobe and Microsoft are being required to build in backdoors. However, you can read the signs, and the signs are pretty clear if you ask me.

Windows has been full with security exploits for two decades with slap-forehead things like doing truetype rendering in kernel mode (or other GDI builtin-exploits). If this happens accidentially, you should think that every programmer at Microsoft and every team leader is a complete idiot, and no such thing as quality review or the like ever happens.

The same goes for major Adobe products such as Flash and PDF. How is the 201x PDF different from the 199x PDF? Only in features that deliberately implement exploits. Really, who needs scripting for something that is supposed to display a report, a paper, or a book? Why do those scripts need to be able to write to the filesystem (WTF, really)? Why is there no way in Reader's so-called safe mode to enable printing a document (which is rather harmless security-wise, worst that can happen is that someone prints out 20 black pages and wastes some of your toner...) without also completely dropping your pants and enabling everything else? Surely, if I want to print out a document, I also want to allow it to run scripts and write to my harddisk. Who doesn't want that. The guys at Adobe are just stupid? You think so?